From dd1c0a0bd66689cfceefea4ed6176bba6e71f381 Mon Sep 17 00:00:00 2001 From: Dylan Conway Date: Sun, 1 Nov 2026 00:21:55 -0700 Subject: [PATCH 1/2] ci: publish to npm with trusted publishing --- .github/workflows/release.yml | 10 ++++++---- packages/bun-release/.npmrc | 1 - 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 331d8a5e8b23..3ce3f2b93eeb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -93,6 +93,7 @@ jobs: if: ${{ github.event_name != 'workflow_dispatch' || github.event.inputs.use-npm == 'true' }} permissions: contents: read + id-token: write defaults: run: working-directory: packages/bun-release @@ -103,6 +104,10 @@ jobs: persist-credentials: false # To workaround issue ref: main + - name: Setup Node.js + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + with: + node-version: latest - name: Setup Bun uses: ./.github/actions/setup-bun with: @@ -113,7 +118,6 @@ jobs: run: bun upload-npm -- "$BUN_VERSION" publish env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - NPM_TOKEN: ${{ secrets.NPM_TOKEN }} npm-types: name: Release types to NPM runs-on: ubuntu-latest @@ -122,6 +126,7 @@ jobs: if: ${{ github.event_name != 'workflow_dispatch' || github.event.inputs.use-types == 'true' }} permissions: contents: read + id-token: write defaults: run: working-directory: packages/bun-types @@ -160,11 +165,8 @@ jobs: - name: Release if: ${{ env.BUN_VERSION == 'canary' || env.BUN_LATEST == 'true' }} env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - NPM_CONFIG_USERCONFIG: ${{ runner.temp }}/.npmrc NPM_TAG: ${{ env.BUN_VERSION == 'canary' && 'canary' || 'latest' }} run: | - echo '//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}' > "$NPM_CONFIG_USERCONFIG" VERSION=$(node -p 'require("./package.json").version') if [ "$(npm view bun-types@"$VERSION" version 2>/dev/null)" = "$VERSION" ]; then echo "bun-types@$VERSION already published, skipping" diff --git a/packages/bun-release/.npmrc b/packages/bun-release/.npmrc index aa0ab1f070b7..6decf642bf66 100644 --- a/packages/bun-release/.npmrc +++ b/packages/bun-release/.npmrc @@ -1,2 +1 @@ @oven:registry=https://registry.npmjs.org/ -//registry.npmjs.org/:_authToken=${NPM_TOKEN} From 4e3b06076a86878a142093b9635e7e3bf3f50353 Mon Sep 17 00:00:00 2001 From: Dylan Conway Date: Sun, 1 Nov 2026 00:48:26 -0700 Subject: [PATCH 2/2] ci: set NPM_CONFIG_PROVENANCE to false in the npm jobs --- .github/workflows/release.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3ce3f2b93eeb..5b731eb45c20 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -118,6 +118,7 @@ jobs: run: bun upload-npm -- "$BUN_VERSION" publish env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + NPM_CONFIG_PROVENANCE: "false" npm-types: name: Release types to NPM runs-on: ubuntu-latest @@ -166,6 +167,7 @@ jobs: if: ${{ env.BUN_VERSION == 'canary' || env.BUN_LATEST == 'true' }} env: NPM_TAG: ${{ env.BUN_VERSION == 'canary' && 'canary' || 'latest' }} + NPM_CONFIG_PROVENANCE: "false" run: | VERSION=$(node -p 'require("./package.json").version') if [ "$(npm view bun-types@"$VERSION" version 2>/dev/null)" = "$VERSION" ]; then